I'm getting the following error:

2018/10/30 20:52:22 [ERROR] NodeController c-jtf7t/m-z45nn [node-controller] failed with : Error with pre-create check: "Failed to authenticate using service principal credentials: Request failed: subscriptions.Client#Get: Failure sending request: StatusCode=0 -- Original Error: Get https://management.azure.com/subscriptions/{subscription}?api-version=2015-11-01: dial tcp: i/o timeout"

But I know that URL is correct. I can manually generate a bearer token and hit that URL just fine. Only Rancher doesn't work. So I know my app id and the secret work and have the appropriate permissions. Can I put the bearer token in the template somewhere? Is that what it really wants?